5787 matches found
EUVD-2026-90414
DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host...
CVE-2026-51866
Versions 0.7.5 through 0.8.0 of DB-GPT are vulnerable to a code injection issue (CWE-94). An attacker can upload a malicious skill via the /api/v1/skills/upload endpoint, which can subsequently be executed during the /api/v1/chat/react-agent flow. The impact includes potential compromise of confi...
EUVD-2026-90418
DB-GPT 0.8.0 contains directory traversal in skillupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py:40. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...
CVE-2026-51869
DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host...
CVE-2026-102876 SurrealDB before 3.3.0 Cross-Tenant Access via Headers
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...
CVE-2026-102876: Authorization Bypass Through User-Controlled Key
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where checkauth verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can...
HPE Integrated Lights-out 4 (ILO4) <2.53 - Authentication Bypass
HPE Integrated Lights-out 4 iLO 4 prior to 2.53 was found to contain an authentication bypass and code execution vulnerability. id: CVE-2017-12542 info: name: HPE Integrated Lights-out 4 ILO4 2.53 - Authentication Bypass author: pikpikcu severity: critical description: HPE Integrated Lights-out 4...
Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure
Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to retrieve sensitive information due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and...
Webmin <= 1.920 - Unauthenticated Remote Command Execution
Webmin =1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in passwordchange.cgi. id: CVE-2019-15107 info: name: Webmin = 1.920 - Unauthenticated Remote Command Execution author: bp0lr severity: critical description: Webmin =1.920. is vulnerable to an...
CVE-2026-6831
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
CVE-2026-6831
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to a missing authorization flaw in versions up to and including 2.1.1 (specifically mentioned as 2.0.9 in several records). The root cause is the plugin's failure to properly verify user permissions before performing actions. This ...
CVE-2026-6831 Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
CVE-2026-6831 Advanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
EUVD-2026-85112
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
CVE-2026-6831: Missing Authorization
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
PT-2026-97203
Name of the Vulnerable Software and Affected Versions Advanced Contact form 7 DB versions prior to 2.1.0 Description The plugin fails to properly verify if a user is authorized to perform specific actions. This missing authorization allows authenticated attackers with Contributor-level access or...
WordPress Advanced Contact form 7 DB plugin <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure vulnerability
Missing Authorization to Authenticated Contributor+ Information Disclosure vulnerability discovered by Quốc Huy jtwings in WordPress Plugin Advanced Contact form 7 DB versions = 2.1.1...
EUVD-2026-82591
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...
CVE-2026-87701
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...
CVE-2026-87701
Azure Cosmos DB is affected by an injection vulnerability (improper neutralization of special elements in output used by a downstream component) that allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 9.6 (CRITICAL) , with a vector of AV:N/AC:L/PR:L/UI:N/S:...